{"id":70834,"date":"2020-02-21T14:42:19","date_gmt":"2020-02-21T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/9-fortinet-getting-started-v6-0-logirovanie-i-otchetnost"},"modified":"2020-03-03T16:14:45","modified_gmt":"2020-03-03T13:14:45","slug":"9-fortinet-getting-started-v6-0-logirovanie-i-otchetnost","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/9-fortinet-getting-started-v6-0-logirovanie-i-otchetnost","title":{"rendered":"9. Fortinet Za\u010d\u00edn\u00e1me v6.0. Logov\u00e1n\u00ed a reportov\u00e1n\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"9.
\n
\nDobr\u00fd den! V\u00edtejte na dev\u00e1t\u00e9 lekci kurzu Fortinet Getting Started<\/a><\/noindex>. Na minul\u00e9m kurzu<\/a><\/noindex> Probrali jsme z\u00e1kladn\u00ed mechanismy kontroly p\u0159\u00edstupu u\u017eivatel\u016f k r\u016fzn\u00fdm zdroj\u016fm. Nyn\u00ed p\u0159ed n\u00e1mi stoj\u00ed jin\u00fd \u00fakol \u2014 mus\u00edme analyzovat chov\u00e1n\u00ed u\u017eivatel\u016f v s\u00edti a nastavit sb\u011br dat, kter\u00e1 mohou pomoci p\u0159i vy\u0161et\u0159ov\u00e1n\u00ed r\u016fzn\u00fdch bezpe\u010dnostn\u00edch incident\u016f. V t\u00e9to lekci se proto pod\u00edv\u00e1me na mechanismus logov\u00e1n\u00ed a reportov\u00e1n\u00ed. K tomu n\u00e1m poslou\u017e\u00ed FortiAnalyzer, kter\u00fd jsme nasadili na za\u010d\u00e1tku kurzu. Pot\u0159ebn\u00e1 teorie a video lekce jsou k dispozici pod odkazem.<\/a><\/noindex><\/p>\n

V FortiGate se logy d\u011bl\u00ed na t\u0159i typy: logy o provozu, logy ud\u00e1lost\u00ed a logy zabezpe\u010den\u00ed. Ty se d\u00e1le d\u011bl\u00ed na podtypy. <\/p>\n

Logy o provozu zaznamen\u00e1vaj\u00ed informace o toku provozu, jako jsou po\u017eadavky a odpov\u011bdi, pokud existuj\u00ed. Tento typ obsahuje podtypy Forward, Local a Sniffer.<\/p>\n

Podtyp Forward obsahuje informace o provozu, kter\u00fd FortiGate bu\u010f p\u0159ijal, nebo odm\u00edtl podle politiky firewallu.<\/p>\n

Podtyp Local obsahuje informace o provozu p\u0159\u00edmo z IP adresy FortiGate a z IP adres, ze kter\u00fdch je prov\u00e1d\u011bna spr\u00e1va. Nap\u0159\u00edklad \u2014 p\u0159ipojen\u00ed k webov\u00e9mu rozhran\u00ed FortiGate.<\/p>\n

Podtyp Sniffer obsahuje logy provozu, kter\u00fd byl zachycen pomoc\u00ed zrcadlen\u00ed provozu.<\/p>\n

Logy ud\u00e1lost\u00ed obsahuj\u00ed syst\u00e9mov\u00e9 nebo administrativn\u00ed ud\u00e1losti, jako jsou \u2014 p\u0159id\u00e1n\u00ed nebo zm\u011bna parametr\u016f, ustanoven\u00ed a ukon\u010den\u00ed VPN tunel\u016f, ud\u00e1losti dynamick\u00e9ho sm\u011brov\u00e1n\u00ed a tak d\u00e1le. V\u0161echny podtypy jsou zn\u00e1zorn\u011bny na obr\u00e1zku n\u00ed\u017ee.<\/p>\n

A t\u0159et\u00ed typ p\u0159edstavuje logy zabezpe\u010den\u00ed. Do t\u011bchto log\u016f se zaznamen\u00e1vaj\u00ed ud\u00e1losti spojen\u00e9 s viry, n\u00e1v\u0161t\u011bvami zak\u00e1zan\u00fdch obsah\u016f, pou\u017e\u00edv\u00e1n\u00edm zak\u00e1zan\u00fdch aplikac\u00ed a tak d\u00e1le. Kompletn\u00ed seznam je tak\u00e9 zn\u00e1zorn\u011bn na obr\u00e1zku n\u00ed\u017ee. <\/p>\n

\"9.
\n
\nLogs can be stored in different locations \u2014 both on the FortiGate itself and externally. Storing logs on FortiGate is considered local logging. Depending on the device, logs can be stored either in the device's flash memory or on a hard drive. Typically, mid-range models have a hard drive. Models with a hard drive can be easily distinguished \u2014 they have a '1' at the end. For example, the FortiGate 100E does not come with a hard drive, while the FortiGate 101E does. <\/p>\n

Younger and older models usually do not have a hard drive. In such cases, flash memory is used to store the logs. However, it should be noted that constant log writing to flash memory can reduce its efficiency and lifespan. Therefore, log writing to flash memory is disabled by default. It is recommended to enable it only for logging events during the resolution of specific issues. <\/p>\n

With intensive log writing, whether to a hard drive or flash memory, the device's performance will decrease.<\/p>\n

\"9.
\n
\nIt is quite common to store logs on remote servers. FortiGate can store logs on Syslog servers, on FortiAnalyzer, or FortiManager. Additionally, the FortiCloud cloud service can also be used for log storage. <\/p>\n

\"9.
\n
\nSyslog is a server for centralized log storage from network devices.
\nFortiCloud is a subscription-based security management and log storage service. It allows for remote log storage and the creation of corresponding reports. If you have a relatively small network, using this cloud service may be a better solution than purchasing additional hardware. There is a free version of FortiCloud that allows for one week of log storage. After purchasing a subscription, logs can be stored for up to a year. <\/p>\n

FortiAnalyzer and FortiManager are external log storage devices. Since they all share the same operating system \u2014 FortiOS \u2014 integration of FortiGate with these devices is straightforward. <\/p>\n

Je v\u0161ak t\u0159eba poznamenat rozd\u00edly mezi za\u0159\u00edzen\u00edmi FortiAnalyzer a FortiManager. Hlavn\u00edm c\u00edlem FortiManageru je centralizovan\u00e9 \u0159\u00edzen\u00ed n\u011bkolika za\u0159\u00edzen\u00ed FortiGate \u2014 proto je kapacita pam\u011bti pro ukl\u00e1d\u00e1n\u00ed log\u016f na FortiManageru zna\u010dn\u011b men\u0161\u00ed ne\u017e na FortiAnalyzeru (pokud samoz\u0159ejm\u011b porovn\u00e1v\u00e1me modely ze stejn\u00e9ho cenov\u00e9ho segmentu). <\/p>\n

Hlavn\u00edm c\u00edlem FortiAnalyzeru je pr\u00e1v\u011b sb\u011br a anal\u00fdza log\u016f. Proto se pr\u00e1v\u011b jeho pou\u017eit\u00edm budeme d\u00e1le zab\u00fdvat v praxi. <\/p>\n

Ve\u0161ker\u00e1 teorie, stejn\u011b jako praktick\u00e1 \u010d\u00e1st, jsou prezentov\u00e1ny v tomto video v\u00fdkladu:<\/p>\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center>
\nV n\u00e1sleduj\u00edc\u00ed lekci se pod\u00edv\u00e1me na kl\u00ed\u010dov\u00e9 aspekty spojen\u00e9 s administrac\u00ed za\u0159\u00edzen\u00ed FortiGate. Abyste ji nezme\u0161kali, sledujte aktualizace na n\u00e1sleduj\u00edc\u00edch kan\u00e1lech:<\/p>\n